CVE-2026-84310: pypdf: Possible long runtimes/large memory usage when retrieving outlines
Impact
An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths.
Patches
This has been fixed in pypdf==6.16.1.
Workarounds
If you cannot upgrade yet, consider applying the changes from PR #3966.
Other sources
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/doccommon.py getoutline to consume long runtimes and large amounts of memory when retrieving document outlines with large numbers of entries or deeply nested reused paths because the traversal lacked global entry-count and nesting-depth limits. This issue is fixed in version 6.16.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pypdfto a version that resolves this vulnerability.Fixed in 6.16.1 - Upgrade
Upgrade
pypdfto a version that resolves this vulnerability.Fixed in 6.16.1 - Compensating control
If upgrading is not yet possible, apply the changes from PR #3966.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using pypdf versions before 6.16.1 are exposed when they retrieve outlines from attacker-crafted PDFs. The impact is long runtimes and high memory consumption during outline traversal.
What does an attacker need to do to trigger the issue?
An attacker needs to provide a crafted PDF with a large number of outline entries or deeply nested reused outline paths, and the application must retrieve the document outlines.
Are applications affected simply by handling a PDF?
The described behavior is triggered when pypdf retrieves document outlines. The available information does not indicate that other PDF operations alone trigger it.
What is the remediation?
Upgrade pypdf to version 6.16.1, which adds global limits for outline entry counts and nesting depth.